CVE-2026-62384: NLTK Path Traversal Vulnerability

CVE-2026-62384 Overview

CVE-2026-62384 is a symlink-based sandbox bypass in the Natural Language Toolkit (NLTK) affecting versions before 3.10.2. The flaw resides in the FramenetCorpusReader component, where path validation fails to account for symbolic links resolving outside the corpus root. Attackers who can place a symlink inside the corpus subdirectory can read arbitrary XML files on the host filesystem. Exploitation occurs when applications invoke frame_by_name(), _lu_file(), or doc() methods against attacker-influenced names. The weakness is categorized as [CWE-22] Path Traversal.

Critical Impact
Attackers can bypass NLTK's corpus sandbox to read arbitrary XML files outside the intended corpus root, exposing sensitive configuration or credential data accessible to the NLTK process.

Affected Products

NLTK versions prior to 3.10.2
Python applications using FramenetCorpusReader with untrusted corpus content
Downstream NLP pipelines that expose frame lookup APIs to external input

Discovery Timeline

2026-08-22 - CVE-2026-62384 published to the National Vulnerability Database
2026-08-24 - Last updated in NVD database

Technical Details for CVE-2026-62384

Vulnerability Analysis

The vulnerability affects the FramenetCorpusReader class in NLTK. The reader enforces a path validation guard that rejects filenames containing path separators to prevent traversal outside the corpus root. However, the guard inspects only the filename string and does not resolve symbolic links before performing the containment check.

An attacker who can write a file into the corpus subdirectory can place a symlink whose name has no / or \ characters. The name passes validation, but the operating system resolves the symlink target to an arbitrary path on disk when NLTK reads the file. Any XML file readable by the NLTK process becomes accessible through the exposed APIs.

Exploitation requires the attacker either to control corpus contents or to trick a user into installing a malicious corpus. Applications that permit user-supplied frame names amplify the impact by turning file disclosure into a network-reachable primitive.

Root Cause

The root cause is missing symlink resolution during path containment validation. The guard checks the string form of the requested filename rather than the canonical resolved path. NLTK should resolve the target with os.path.realpath() and verify the result stays inside the corpus root before opening the file.

Attack Vector

The attack requires that a symlink be placed within the FrameNet corpus subdirectory. The malicious link name must contain no path separators. When application code calls frame_by_name(), _lu_file(), or doc() with a name matching the symlink, NLTK opens the linked target and returns its parsed XML contents to the caller. Refer to the GitHub Security Advisory and the VulnCheck Advisory for additional technical details.

// No verified proof-of-concept code is published. See the linked advisories for details.

Detection Methods for CVE-2026-62384

Indicators of Compromise

Symbolic links present within FrameNet corpus subdirectories whose targets resolve outside the corpus root
Unexpected reads of system XML files (for example, configuration or credential files) by Python processes hosting NLTK
Application logs showing frame lookups for names that do not correspond to legitimate FrameNet entries

Detection Strategies

Inventory installed NLTK versions across development, build, and production systems and flag any release earlier than 3.10.2
Audit corpus directories for symbolic links using find <corpus_root> -type l and validate that each target remains inside the intended root
Monitor Python runtime file access telemetry for XML reads outside expected corpus paths

Monitoring Recommendations

Enable filesystem auditing on directories that store NLTK corpora and alert on symlink creation events
Track process-level file opens from Python interpreters that load nltk.corpus.framenet modules
Correlate application logs of frame_by_name() and doc() invocations with the file paths ultimately opened by the process

How to Mitigate CVE-2026-62384

Immediate Actions Required

Upgrade NLTK to version 3.10.2 or later on all systems that import the package
Remove any untrusted corpora and inspect existing FrameNet directories for symbolic links
Restrict write permissions on corpus directories to trusted administrators only

Patch Information

The fix is included in NLTK 3.10.2. Release details and the maintainer advisory are available in the NLTK GitHub Security Advisory GHSA-f833-7jw8-xwrv. Update through the package manager, for example pip install --upgrade nltk, and rebuild any container images or virtual environments that pin an earlier version.

Workarounds

Deploy NLTK corpora on filesystems mounted with the nosymfollow option where supported
Run a startup script that removes symbolic links from configured corpus roots before the application loads
Sandbox the NLTK process with least-privilege file access so that sensitive XML files remain unreadable

bash

# Upgrade NLTK and verify the installed version
pip install --upgrade 'nltk>=3.10.2'
python -c "import nltk; print(nltk.__version__)"

# Enumerate symlinks inside a FrameNet corpus root
find "$NLTK_DATA/corpora/framenet_v17" -type l -printf '%p -> %l\n'